smurfmonitor/dns-iptables-rules — pull request #5 by bwaters (2013-09-26 14:11:10+00:00)
Title: Feel free to ignore the python script, looked handy to me.  The path is very helpful for cronning our update script

BTW -- I have an interesting attack, I'm not sure what to do with.

9:08:39.851673 IP 183.60.133.43.7055 > 184.XXX.XXX.XXX: 42370+ [1au] RRSIG? doc.gov. (41)
0x0000: 4500 0045 52fc 0000 fa11 cedb b73c 852b E..ER........<.+
0x0010: b8ad a9ba 1b8f 0035 0031 0000 a582 0100 .......5.1......
0x0020: 0001 0000 0000 0001 0364 6f63 0367 6f76 .........doc.gov
0x0030: 0000 2e00 0100 0029 2328 0000 0000 0000 .......)#(......
0x0040: 0000 0000 00

Its a legitimate domain - I don't want to block doc.gov. Thinking it would be good to modify the script to have a limit target instead of just dropping all the time. Then the master list we would need to have a way to distingish definate attacks from maybe attacks. Thoughts???